apunkt/vestige
1
0
Fork 0
mirror of https://github.com/samvallad33/vestige.git synced 2026-07-04 22:02:14 +02:00
Code Issues Projects Releases Packages Wiki Activity
vestige/crates/vestige-mcp
History
Sam Valladares a3750378bd fix(audit): 16 verified panic/DoS/correctness bugs (swarm, trivial tier) 
All verified against real code before fixing (49/95 CRITICAL+HIGH confirmed
real; the rest were false positives). This is the low-risk batch:

panics/DoS:
- backfill: clamp scan_limit to [10,5000] + lookback to [1,365] (negative
  scan_limit => SQLite LIMIT -1 => unbounded fetch = DoS)
- trace_recorder/phases: char-boundary-safe truncation (byte-slice &s[..n]
  panics on multi-byte UTF-8)
- compression: saturating_sub on bytes_saved (short inputs compress larger)
- redmine list_live_ids: u64 offset + wrap/page-cap guards (u32 wrap => infinite
  loop + unbounded alloc)
- speculative file_memory_map: dedup + cap (was unbounded growth)

correctness:
- dreams stage1_replay: select most-recent-N then order, not first-N-then-sort
- prediction_error: count total_evaluations in direct evaluate_with_intent
  branches (rates could exceed 1.0)
- relationships: reject duplicate ids (silent overwrite corrupted the index)
- github: validate owner/repo charset (raw URL-path interpolation)
- reconsolidation: document the (already-correct) idempotency via remove()

core 535/0, mcp 453/0, clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-28 14:03:54 -05:00
..
src fix(audit): 16 verified panic/DoS/correctness bugs (swarm, trivial tier) 2026-06-28 14:03:54 -05:00
Cargo.toml feat(cloud-sync): HTTP managed-sync backend + vestige sync --cloud 2026-06-19 20:35:01 -05:00
README.md Add ComposedGraph composition ledger 2026-06-18 16:00:29 -05:00

README.md

Vestige MCP Server

Local cognitive memory for MCP-compatible AI agents.

This crate provides the vestige-mcp stdio MCP server plus the vestige CLI. The cognitive engine lives in vestige-core; this crate owns protocol handling, tool dispatch, optional dashboard serving, backups, restore, update, and portable import/export commands.

Install

For normal users, prefer the release package:

npm install -g vestige-mcp-server

For local development:

cargo build --release -p vestige-mcp

Register With An MCP Client

Use the command vestige-mcp in any stdio MCP client:

{
  "mcpServers": {
    "vestige": {
      "command": "vestige-mcp"
    }
  }
}

Examples:

claude mcp add vestige vestige-mcp -s user
codex mcp add vestige -- vestige-mcp

Transports

  • Default: JSON-RPC 2.0 over stdio.
  • Optional: MCP-over-HTTP on /mcp, enabled only with --http, --http-port, or VESTIGE_HTTP_ENABLED=1.
  • Dashboard: vestige dashboard or VESTIGE_DASHBOARD_ENABLED=1.

HTTP and dashboard bearer tokens are generated locally; see docs/CONFIGURATION.md.

Current Tool Surface

The server exposes the current unified MCP tools from src/server.rs, including:

  • session_context
  • search, smart_ingest, memory, codebase, intention
  • deep_reference, cross_reference, contradictions
  • dream, explore_connections, predict
  • memory_health, memory_graph, composed_graph, system_status
  • importance_score, find_duplicates
  • consolidate, memory_timeline, memory_changelog
  • backup, export, restore, gc, suppress

See the root README.md and docs/AGENT-MEMORY-PROTOCOL.md for agent instructions.

License

AGPL-3.0-only